website-uptime-monitor

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt embeds proxy credentials (USER:PASS) directly in environment variables and curl/connection strings, which instructs the agent to place secret username/password values verbatim into commands/outputs—an insecure exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to fetch and verify live pages from arbitrary target websites (e.g., the "HTTP Status Check" curl example and the "Content Verification" section using BirdProxies gateway to fetch https://yoursite.com), so it consumes untrusted third-party web content that can materially influence alerts and subsequent actions.